Monitor files with inputs.conf

herokhoo90 — Wed, 17 Jun 2020 09:41:14 GMT

I would like to check will there be any impact if i use inputs.conf to monitor those files (i.e. 1000+) that do not exist yet? This is to prepare for data on-boarding.

Will Splunk keep searching for the files and write error message into splunk log, which result in performance issue or other issue?

Thanks.

Re: Monitor files with inputs.conf

richgalloway — Wed, 17 Jun 2020 13:21:26 GMT

You can put non-existent files in your monitor stanzas. Splunk will silently wait for them to be created.

topic Re: Monitor files with inputs.conf in Getting Data In

Monitor files with inputs.conf

Re: Monitor files with inputs.conf